Registry Policy

1. Introduction and Purpose

1. MYNIC is the Registry for the top-level Malaysian Internet Domain ".MY" CCTLD, whose core business is the registration of domain names, administration, and technical operation of the national domain registry as well as promoting the development of the Domain Name System ('DNS') in Malaysia. MYNIC may appoint accredited Registrars, set policies, and enter into the necessary agreements with multiple Registrars accordingly.
2. This Policy aims to set MYNIC's roles and responsibilities as the Registry to manage the .MY domain and ongoing registry operations include providing registry services while ensuring stability, security & integrity of the registry database.
3. MYNIC, as the Registry is responsible for providing registry services that includes customer database administration, zone file publication, DNS and DNSSEC operation, marketing, and Policy determination. MYNIC may appoint a third party to provide a shared registry system.
4. This Policy applies to all .MY domain name registration and must be complied with by both Registrars and Registrants including but not limited to all other policies that are made available on MYNIC's official website.

2. Definition of Terms

3. General Principles

1. As and when required, MYNIC shall update the Policy accordingly to reflect any changes in either internal or external circumstances to avoid conflicts or inconsistencies
2. The Policy shall be reviewed in its entirety on an annual basis when required to ensure its contents' continued relevance and appropriateness.
3. The Registry Policy is confidential and contains proprietary information of MYNIC. The Registry Policy and any of the information contained therein shall not be reproduced or disclosed to any unauthorized third party under any circumstances without the express written permission of MYNIC.

4. Role and Responsibilities of Registry

1. The digital economy standpoint relies heavily on Internet, ICT system and applications, in which the Internet is composed of three major components which are the network, the host and the address (domain name). Therefore, domain name is a critical component of the digital economy.
   • The domain name industry consists of four (4) major roles which are the Registry Operators, Registry Service Providers, Registrars and Resellers. The Registry Operator scope covers the management, administration, and promotion of a Top-Level Domain, whereas the Registry Service Provider manage the technical operations in support of the Registry.
   • Typically, a Registry Service Provider can be managed in-house by the Registry Operator or outsourced to the Registry Service Provider. The Registry Service Provider can perform the technical operations of the Registry, connecting the Registry to the DNS and to Registrars.
   
   Figure 1 – The Domain Name Industry Ecosystem (Source: ICANN)

The Registry roles and Responsibilities are as follows:-


2. Technical and Security
   • Manage and maintain the stability, security, safety, confidentiality, availability, and integrity of the Registry Database for .MY Top-Level Domain such as the .MY Top-Level Domain Names zones and operate the Master Name Server(s);
   • Publish and propagate signed DNS zone files updates to the world via secondary DNS servers;
   • Provide DNS service availability and WHOIS service for public to query all .MY domain names such as the availability of the authoritative nameservers to respond to DNS queries from Internet users and availability of WHOIS service via relevant port and on the website;
   • All zones must be signed with the valid key that is published in IANA to ensure the authenticity of the .MY DNS records. It is also important to maintain, update the keys on a timely basis and ensure the cryptographic keys are strongly protected according to best practices;
   • Comply to Extensible Provisioning Protocol (EPP) for integration between Registry and Registrar. Implementation of the EPP in conformance with the standard and informational RFCs published by the IETF or any successor standards, versions, modifications, or additions thereto as reasonably necessary;
   • Key signing key (KSK) must be changed on a timely basis to protect against key being compromised through prudent risk management practice;
   • Generation of the KSK algorithm and key strength must comply with industry practices to protect the .MY zones that are used in the digital economy;
   • DNS Technology used must be reviewed every three years to ensure adequacy towards current industry standards implementation;
   • Protect and mitigate the internal and external security risks of the .MY Top-Level Domain. Sources of alerts can originate from Internal Security Monitoring, Government Law Enforcement Authority, Regulator, and any entities with the requisite expertise in the appropriate field and security reporting organizations; and
   • Any complaints on technical abuse from the public must be investigated and verified to assurance to this public.
3. Operation,
   • Appoint and manage the Registrars;
   • Setting and maintaining the price for all .MY categories;
   • Setting the policies and procedures for .MY domain names;
   • Manage the domain registration and life cycle which outlines the domain name creation, selection, registration, modification, or deletion;
   • Establish contact points and maintain relationship with international and regional organisations such as ICANN, IANA, APTLD, APNIC and others; and
   • Implement regulations or directives from Regulator, Ministry, and the Government.
4. Compliance and Enforcement
   • Perform role as back-up Registrar, should any Registrar fail to perform their obligations. The Registry will manage the Registrants and continue to ensure compliance of the Policy;
   • The Registry can assign the Registrants to another Registrar in compliance to this Policy;
   • Comply with and implement decisions from KKD under the CMA 1998 and/or the Regulator under the NEAP;
   • Adopt established industry standards such as ISO standards (e.g., Business Continuity Management System) in the continuity of registry services and overall registry continuity for the life of the .MY top-level domain; and
   • Comply with Malaysian laws and regulations in the management and administration of .MY top-level domain. The Registry will comply with data privacy and data protection laws that can impact specific areas of the operations such as handling registration data, WHOIS Directory while maintaining the stability and security of the registry database for the .MY Top-Level Domain.
5. Dispute Resolution
   • Maintain platform and mechanism to address complaints and domain name disputes in accordance with the .MY Dispute Resolution Policy;
   • Appoint an independent third-party service provider to administer the Dispute Resolution Policy; and
   • Ensure the Registrars comply with the panel decisions, in accordance with the .MY Dispute Resolution Policy.
6. Marketing and Awareness
   • Raising marketing and awareness on the importance of .MY domain names in the digital economy and DNS-related technology;
   • Develop a Registry-Registrar market strategy, attractive pricing, incentive, and compensation model to amplify market penetration and broaden awareness to increase sales of .MY domain names;
   • Review the performance of registrars and the business models periodically to ensure their performance is in accordance with the current Registrar’s policy and current industry standards; and
   • Continuously engaging with Registrars by providing updated marketing and promotional materials, training, and enablement program to promote the .MY Top-Level Domain effectively.

5. Review of Policy

1. Modification may be necessary, among other reasons, to maintain compliance with laws and regulations or accommodate organizational changes within MYNIC. Legal shall review this Policy annually or when required, to ensure continued relevance and appropriateness of contents.